1. Field of the Invention
The present invention generally relates to a method of and system for making purchases over a computer network and, more particularly, to a method of and system for making purchases of goods and services over the Internet or other non-secure computer network using an automated-teller-machine (ATM) card, debit card or any other card which may require a valid personal-identification-number (PIN) for transaction authorization.
2. Description of the Prior Art
The use of personal computers by consumers to purchase goods and services over the Internet via the World Wide Web and e-mail has become very popular in recent years and constitutes an ever-increasing part of the economy. In making a purchase over the Internet, the typical consumer uses a credit card or ATM card. After making his purchase selection, the consumer transmits his card information over the Internet to the on-line merchant. The on-line merchant then contacts the issuing bank to verify the card information and obtain authorization to complete the transaction. Depending on the response from the bank, the on-line merchant either accepts or rejects the purchase.
Because the Internet is a non-secure (i.e., public) network, there is a danger that the consumer's credit card or ATM card information will be intercepted by a third party. If that third party is dishonest, he can make illegal charges to the credit card or, in the case of an ATM card, remove money directly from the consumer's bank account. In recent years, numerous approaches have been implemented to reduce this security risk. The most popular approach has been sophisticated encryption techniques which render the credit card or ATM card data virtually unreadable to third parties, such as 128-bit secure-sockets-layer (SSL) encryption.
When making purchases over the Internet using an ATM card, however, security considerations take on an added importance because, unlike with transactions at ATM machines, PINs are presently not used in ATM transactions on the Internet. Thus, should the ATM card number fall into the hands of an unscrupulous third party, the card-holder's entire bank account can be wiped out through fraudulent Internet transactions.
One way to overcome this problem is to require the use of PINs in ATM transactions on the Internet. This has not been possible to date, however, because on-line merchants do not have the ability to verify PINs. Additionally, it is not desirable to provide the on-line merchant with both the ATM card number and the corresponding PIN since unscrupulous employees of the on-line merchant can use the PIN to illegally access the card-holder's bank account and withdraw money therefrom.
Accordingly, it is an object of the present invention to provide a new method of and system for making purchases over the Internet using an ATM card wherein a valid PIN is required in order to obtain authorization for a given transaction. It is another object of the present invention to provide a new method of and system for making purchases over the Internet using an ATM card wherein a valid PIN is required in order to obtain authorization for a given transaction, and wherein the PIN is not supplied to the on-line merchant.